ADR-0007: Anonymous-first — no safety capability sits behind an account

Status: Accepted Date: 2026-09-02

Decisions

D-09 No safety capability ever requires authentication, and the app opens on Home

Login moves out of the startup path into Settings. Search history is device-local and works anonymously. An account buys exactly two things: cross-device sync and saved favourites.

Context

R-08 records that the source says usable without logging in twice — on screen 1 and again on the title-block mockup. Stated twice usually means someone insisted. Yet login is numbered screen 1, implying a front door, and R-15 shows timestamped history, which is the classic feature that quietly migrates behind an account.

The emergency case decides it: nobody registers an account with a spill in progress, and a login wall at that moment is the product failing the speed-of-access problem R-02 names. Screen 1's position is read as a layout convention, not a product decision.

Rejected options

• Keep login as screen 1 with a visible skip — rejected: truer to the source's ordering but puts a step between the user and the thing they opened the app for.
• Gate history and favourites behind an account — rejected because R-15 shows history with no account context, and it gives the app a reason to nag.
• No accounts at all — rejected as contradicting the source, which clearly shows both register and login.

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it. In particular, do not move a feature behind login to drive registration.

Coverage

Upstream	Landed in	Evidence	Note
R-08	D-09	the twice-stated no-login line is the deciding evidence
R-15	D-09	history kept device-local and anonymous